§650 Definitions

Summary

Defines key words used in this part of the law so people know what the words mean. Agency is the Cybersecurity and Infrastructure Security Agency. Appropriate congressional committees are the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Homeland Security. Cloud service provider means a company that offers cloud computing services as defined by NIST Special Publication 800‑145. Critical infrastructure information covers three kinds of nonpublic details about infrastructure security: attacks or threats, how able a system is to resist those threats (including tests and risk plans), and past or planned operational problems or fixes related to those threats. Cyber threat indicator is information needed to describe or identify things like malicious scanning, ways to defeat defenses, vulnerabilities, tricks that make users enable attacks, command‑and‑control for attacks, harm or stolen data, or other threat attributes not barred by law. Cybersecurity purpose means protecting systems or the information they hold, process, or send from cyber threats or vulnerabilities. Cybersecurity risk means threats, weaknesses, and the harms that come from unauthorized access, use, disclosure, disruption, or destruction, but it does not include only breaking a consumer term of service or license. Cybersecurity threat means an action on or through an information system that can cause unauthorized harm to its security, availability, confidentiality, or integrity, excluding actions that only break a consumer term of service or license and excluding First Amendment protected activity. Defensive measure means a tool or action used on systems or data to detect, stop, or reduce a known or suspected cyber threat, but not actions that destroy, make unusable, give unauthorized access to, or seriously harm systems or data that the private operator does not own unless proper consent is given. Director means the Director of CISA. Homeland Security Enterprise means the mix of government and non‑government groups involved in homeland security, like federal, state, local, and Tribal officials, private companies, academics, and experts. Incident means an event that actually or almost immediately threatens without legal authority the integrity, confidentiality, or availability of information or an information system. Information Sharing and Analysis Organization is any group set up by public or private entities to collect, study, share, and spread critical infrastructure information and cybersecurity risk or incident information to help prevent, detect, respond to, or recover from problems. Information system has the meaning in 44 U.S.C. 3502 and includes industrial control systems like SCADA, distributed control systems, and programmable logic controllers. Intelligence community has the meaning in 50 U.S.C. 3003(4). Malicious cyber command and control means a way to remotely identify, access, or use a system or its data without authorization. Malicious reconnaissance means actively probing or passively watching a system to find security weaknesses when tied to a known or suspected cyber threat. Managed service provider is a company that delivers ongoing support or runs network, application, infrastructure, or security services at a customer site, the provider’s data center, or a third‑party data center. Monitor means to acquire, find, scan, or hold information that is stored on, processed by, or passing through an information system. National cybersecurity asset response activities include giving technical help to affected entities, finding other at‑risk parties, assessing sector or regional risks and cascading effects, coordinating information and response, and advising how to use federal resources to recover quickly. National security system has the meaning in 40 U.S.C. 11103. Ransomware attack means an incident using or threatening malicious code or other digital methods (like denial of service) to disrupt systems or compromise data to force a ransom payment, but not events where the demand is not genuine or is a good‑faith request by an entity at the owner’s request. Sector Risk Management Agency means a federal department or agency designated by law or the President to provide sector expertise and lead or support programs with the Department. Security control means the management, operational, and technical protections used to defend a system or its information. Security vulnerability means any hardware, software, process, or procedure flaw that could help defeat a security control. Sharing means providing, receiving, or disseminating information. SLTT entity means a State, local, Tribal, or territorial government or any subdivision of them. Supply chain compromise means an incident in a system’s supply chain that an adversary can use, or does use, to harm the system’s confidentiality, integrity, or availability at any point in its life cycle.